Nobody audits every dependency by hand. Something has to watch the registry instead.

#security #opensource #python #javascript

No team reviews the source of every package it installs. At a few hundred transitive dependencies per project, that's not laziness - it's arithmetic. The trust boundary of a modern build is, in practice, "whatever's currently in npm/PyPI," refreshed on every install.

That boundary is under active attack, continuously, not occasionally. Sonatype's 2026 State of the Software Supply Chain report puts a number on it: 454,600 new malicious open-source packages identified in 2025 - typosquats, hijacked maintainer accounts, and packages built specifically to exfiltrate credentials or CI/CD secrets. Averaged out, that's roughly one new malicious package entering the registries every 70 seconds, all year.

The failure mode isn't "nobody knew this class of attack existed." It's timing: a malicious or newly-flagged package sits in a lockfile for days or weeks before anyone finds out, because finding out currently means someone stumbling on a security advisory after the fact.

Malicious Package Watch closes that gap with one job, done on a schedule: given a watchlist of packages (npm, PyPI, Go, crates.io, Packagist, RubyGems, Maven, NuGet), it checks each one against OSV.dev - the open vulnerability database aggregating GitHub Security Advisories, PyPA, npm, and RustSec - and reports only advisories that are new since the previous check. The first run establishes a silent baseline; nothing is reported as "new" that was already known. Every run after that reports exactly what changed, and nothing else.

Verified against the live API before release: a baseline check on lodash correctly surfaces its 10 existing advisories as history, not alerts; a second check against the same watchlist with no new advisories published in between returns nothing. That's the behavior the tool exists to guarantee - silence when nothing changed, a signal the moment something does.

https://apify.com/0xgollum/malicious-package-watch

Source: Sonatype 2026 State of the Software Supply Chain - Open Source Malware (https://www.sonatype.com/state-of-the-software-supply-chain/2026/open-source-malware)